Monitor and Control for Distributed System

ABSTRACT

Methods, systems, and apparatuses are described that can encode connection information between consumers and providers for displaying to users. In an example aspect, a distributed control system includes a production network configured to perform automated control operation. The production network can include one or more data extraction nodes and a plurality of devices in communication with the data extraction nodes. The data extraction nodes are configured to collect data from the plurality of devices. The data indicates connection information associated with the plurality of devices. The system can further include a screen configured to display a plurality of interfaces that include the plurality of devices represented as consumers and providers. In some cases, the screen defines a single desktop monitor or a mobile device display.

BACKGROUND

A distributed system generally refers to a system having components thatare located on different networked computers, which communicate andcoordinate their actions by passing messages to one another. A givendistributed system can be very large with many components. In somecases, a given component is a provider of messages to other components,and a receiver of messages from other components. In suchconfigurations, the number of bidirectional connections for n componentscan be computed as:

${{Number}\mspace{14mu}{of}\mspace{14mu}{bidirectional}\mspace{14mu}{communication}\mspace{14mu}{path}\mspace{14mu}(n)} = {{2 \cdot \frac{n\left( {n - 1} \right)}{2}} = {n^{2} - {n.}}}$

A distributed system typically consists of hardware components, softwarecomponents, and firmware. Hardware components and firmware can beassigned to physical locations. A software component can be deployed oncomputer hardware that is assigned to a location, and/or may provide aservice to a virtual software component that is not allocated to aphysical location. Generally distributed systems provide well-definedservices. To provide such services, many distributed systems employ anoperator who monitors and controls the performance of the distributedsystem. The general intent of the operator is often to maximize thesystem's uptime and to respond to abnormal situations (e.g. alerts,alarms) in a timely manner. With respect to abnormal situations, in somecases, a root cause and an effective corrective action need to beidentified, and the corrective action needs to be properly executed toget the system back to a normal system's status.

It is recognized herein that the cognitive load for a human operator tomonitor and control a complex distributed system can be significant forvarious reasons, such as those mentioned above. For example, somedistributed systems can include many system components and manybidirectional connections. Generally, the cognitive load for an operatorincreases as the number of components and connections increase. By wayof example, when an abnormal situation arises in a given distributedsystem, the operator may need to determine the location associated withthe abnormal situation in order to address the situation. Such adetermination can be complicated by the number of components or size ofthe distributed system. Further, it is recognized herein thatcomparisons between the states and behaviors of different systemcomponents can also increase the cognitive load for an operator even ifsystem components are grouped into groups of components (e.g.subsystems), which can result in reduced efficiency for the operator toidentify and diagnose an abnormal situation.

As described above, it is recognized herein that various complexitiesinvolved in monitoring and controlling distributed systems can createcognitive burdens for an operator. It is also recognized herein thatincreased size and complexities of systems can reduce screen real estatethat is available to present or display information to operators. Forexample, as systems increase in size, there is often a need to presentmore information to operators, but there might not be enough displayspace to usefully present such information. Thus, it is recognizedherein that the amount and complexity of information that is displayedto operators can result in mistakes or other technical issues (e.g.,screen real estate issues) associated with monitoring and controlling agiven distributed system.

BRIEF SUMMARY

Embodiments of the invention address and overcome one or more of thedescribed-herein shortcomings by providing methods, systems, andapparatuses that encode connection information between consumers andproviders for displaying to users. In an example aspect, a distributedcontrol system includes a production network configured to performautomated control operation. The production network can include one ormore data extraction nodes and a plurality of devices in communicationwith the data extraction nodes. The data extraction nodes are configuredto collect data from the plurality of devices. The data indicatesconnection information associated with the plurality of devices. Thesystem can further include a screen configured to display a plurality ofinterfaces that include the plurality of devices represented asconsumers and providers. In some cases, the screen defines a singledesktop monitor or a mobile device display. The distributed systemfurther includes a processor and a memory storing instructions that,when executed by the processor, cause the processor to encode theconnection information so as to define encoded connection informationthat indicates one or more properties associated with connectionsdefined between respective providers and respective consumers. Thescreen is further configured to display the encoded connectioninformation between respective consumers and providers. In someexamples, the screen is further configured to display the encodedconnection information as lines that connect providers with consumersthat are associated with respective encoded connection information.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The foregoing and other aspects of the present invention are bestunderstood from the following detailed description when read inconnection with the accompanying drawings. For the purpose ofillustrating the invention, there is shown in the drawings embodimentsthat are presently preferred, it being understood, however, that theinvention is not limited to the specific instrumentalities disclosed.Included in the drawings are the following Figures:

FIG. 1 is a block diagram of an example distributed control system inaccordance with an example embodiment.

FIG. 2 is an example interface for monitoring distributed controlsystems in accordance with an example embodiment.

FIG. 3 depicts another example interface in which a particular consumeris selected from the interface shown in FIG. 2, in accordance with anexample embodiment.

FIG. 4 depicts an example interface for monitoring distributed controlsystems, wherein a plurality of consumers or providers are groupedtogether, in accordance with an example embodiment.

FIG. 5 depicts another example interface in which a particular group ofconsumers is selected from the interface shown in FIG. 4, in accordancewith an example embodiment.

FIG. 6 depicts various connection encodings that can be display byvarious interfaces in accordance with embodiments described herein, suchas the interfaces depicted in FIGS. 2-5.

FIG. 7 illustrates a computing environment within which embodiments ofthe disclosure may be implemented.

DETAILED DESCRIPTION

As an initial matter, distributed systems described herein can beimplemented in various domains. Example domains for distributed systemsinclude, without limitation, manufacturing systems, IT systems (e.g.,including microservices), digital ecosystems (e.g., onlinemarketplaces), social media systems, messaging and news systems, designand engineering systems, cloud services, energy generation systems,energy distribution systems, or the like.

As described herein, the size and complexity of a given distributedsystem can create issues for operators tasked with monitoring andcontrolling such systems. In various example embodiments, to addresssuch issues, a distributed system defines a display that is configuredto display specific information associated with respective normal andabnormal situations. The specific information can include relevantinformation that enables an operator to understand the normal orabnormal situation associated with the relevant information. Thespecific information can also define reduced information as compared toaggregate information that can displayed. Presenting reduced informationcan limit distractions for an operator by removing information deemed tobe irrelevant to the situation at-issue. Further, the specificinformation can include contextual information (e.g., location,circumstance, etc.) associated with the respective situation, such thatspecific information can define rich information.

By way of example, operators can be informed of a situation in a givendistributed system by displaying, among other information, systemelements, connections between system elements, and indicationsconcerning the usage flow of established connections. Displaying suchinformation, however, can result in an overly cluttered display or canbe infeasible due to limited screen real estate. Increasing screen realestate as information increases can also result in impractical orinfeasible display sizes or numbers of display monitors. According toHick-Hyman law (T=b log₂(n+1), n is number of information items; b is aconstant), the time it takes to make a decision depends on the number ofpresented information items to the user. Thus, in some cases, it isrecognized herein that the larger the screen real estate, the moreinformation items are displayed, the longer it takes for the user tomake decisions. It is further recognized herein that this dependency canbe counterproductive for making timely responses in case of abnormalsituations, among others. It is also recognized herein that operatorsmay use mobile devices to access information related to distributedsystem and provide timely responses, and that such devices define arelatively small screen real estate.

Various technical issues are presented when trying to generate aninteraction pattern that is domain-agnostic and that can be used todisplay relevant, reduced, and rich information on limited screen realestate. For example, an operator may need to navigate within a givendistributed system to understand the contribution of a group of systemelements, or individual system elements, to the distributed system. Byway of another example, an operator may need to navigate within a givendistributed system for state visualization. In particular, an operatormay need to understand the current and historical contribution of agroup of system elements, or individual elements, to the systembehavior. Similarly, a display may need to render connection and usageinformation so as to enable an operator to visualize or understand theconnection (e.g., connection status, connection use) between two or moresystem elements. By way of yet another example, a display may need torender information so as to enable an operator to visualize orunderstand an abnormal situation.

Current approaches to displaying information for operations related to adistributed system typically rely on multiple monitors that display aplethora of information. For example, to provide context information forthe information items of a distributed system, the system information istypically displayed in a physical view in which the system elements areorganized in a system topology that resembles the physical structure andlocation of the installed system. A problem with this approach, amongothers, is that it requires a large display. Furthermore, theinformation associated with each system element is displayed in thetopology context, which makes it difficult to use smaller real estatefor the display of the distributed system and its status information.Further still, current approaches typically define a visualization ofthe system elements that is domain-specific and use-case specific. Thus,in some cases, operators need to be retrained when switching operationsfrom one domain to another.

In various embodiments described herein, an interaction pattern isdefined that enables a distributed system to display, for instance on amobile device or other computing device having limited screen realestate, a limited number of information items concerning system elementsand currents uses of the distributed system. Example items that can bedisplayed in a domain-agnostic manner include, without limitation,status information (e.g., normal and abnormal states) and informationconcerning system elements, connections, and connection use. Using thedisplayed information, an operator can effectively monitor a givendistributed system and respond a timely manner.

Referring initially to FIG. 1, an example distributed control system(DCS) defines an industrial control system (ICS) 100 that includes anoffice or corporate IT network 102 and an operational plant orproduction network 104 communicatively coupled to the IT network 102. Itwill be understood that the ICS 100 is illustrated and simplified as anexample, and distributed systems can define other systems in otherdomains having other configurations, and all such distributed systemsare contemplated as being within the scope of this disclosure. Forexample, embodiments of the distributed control system can define anoperational technology system, energy generation system (e.g., windparks, solar parks, etc.), or an energy distribution network. 1 shouldalso list OT (Operational Technology).

The production network 104 can include an abstraction engine 106 that isconnected to the IT network 102. The production network 104 can includevarious production machines configured to work together to perform oneor more manufacturing operations. Example production machines of theproduction network 104 can include, without limitation, robots 108 andother field devices, such as sensors 110, actuators 112, or othermachines, which can be controlled by a respective PLC 114. The PLC 114can send instructions to respective field devices. In some cases, agiven PLC 114 can be coupled to one or more human machine interfaces(HMIs) 116.

The ICS 100, in particular the production network 104, can define afieldbus portion 118 and an Ethernet portion 120. For example, thefieldbus portion 118 can include the robots 108, PLC 114, sensors 110,actuators 112, and HMIs 116. The fieldbus portion 118 can define one ormore production cells or control zones. The fieldbus portion 118 canfurther include a data extraction node 115 that can be configured tocommunicate with a given PLC 114 and sensors 110. In some cases, the PLC114 can define the data extraction node 115. For example, the dataextraction node 115 can run as an application or service on the PLC 114.Alternatively, the data extraction node 115 can run as an application orservice on a stand-alone ruggedized personal computer or can beintegrated with existing servers that can be close to, and coupled with,PLCs 114. The data extraction nodes 115 can be configured to tracecommunication as messages and information is transmitted within the ICS100. Such communication and data associated with the communicationconnections can be displayed to user, for instance via the interfacesdepicted in FIGS. 2-6 that are further described herein.

The PLC 114, data extraction node 115, sensors 110, actuators 112, andHMI 116 within a given production cell can communicate with each othervia a respective field bus 122. Each control zone can be defined by arespective PLC 114, such that the PLC 114, and thus the correspondingcontrol zone, can connect to the Ethernet portion 120 via an Ethernetconnection 124. The robots 108 can be configured to communicate withother devices within the fieldbus portion 118 via a WiFi connection 126.Similarly, the robots 108 can communicate with the Ethernet portion 120,in particular a Supervisory Control and Data Acquisition (SCADA) server128, via the WiFi connection 126. The Ethernet portion 120 of theproduction network 104 can include various computing devicescommunicatively coupled together via the Ethernet connection 124.Example computing devices in the Ethernet portion 120 include, withoutlimitation, a mobile data collector 130, HMIs 132, the SCADA server 128,the abstraction engine 106, a wireless router 134, a manufacturingexecution system (MES) 136, an engineering system (ES) 138, and a logserver 140. The ES 138 can include one or more engineering workstations.In an example, the MES 136, HMIs 132, ES 138, and log server 140 areconnected to the production network 104 directly. The wireless router134 can also connect to the production network 104 directly. Thus, insome cases, mobile users, for instance the mobile data collector 130 androbots 108, can connect to the production network 104 via the wirelessrouter 134. In some cases, by way of example, the ES 138 and the mobiledata collector 130 define guest devices that are allowed to connect tothe abstraction engine 106. The abstraction engine 106 can be configuredto trace communication between the IT network 102 and the productionnetwork 106 and within the production network 106 itself, so thatcommunication and data associated with the communication connections canbe displayed to user, for instance via the interfaces depicted in FIGS.2-6 that are further described herein. It will be understood that guestdevices to the production network 104 can vary as desired.

With continuing reference to FIG. 1, data or information can becollected by the ICS 100, in particular the sensors 110 and the dataextraction node 115. In some examples, the sensors 110 include OS-basedsensors that can be deployed on the OS where the SCADA server 128application is deployed. The sensors 110 can also include OS-basedsensors for engineering workstations (e.g., of the MES 136 and ES 138)or HMIs 132 and 116. Alternatively, or additionally, the sensors 110 canbe embedded on PLCs 114 so as to define embedded PLC-based sensors. Insome cases, the sensors 110 perform listening only, so as to definepassive network-based sensors that can extract data associated withconsequences of user interactions. Alternatively, or additionally, thesensors 110 can perform polling so as to define active network-basedsensors. Such active sensors can query given devices to collect datasuch as, for example, the latest operations performed by users of thedevices. Thus, ICS 100 can include a PLC (and/or other devices) and adata collecting application configured to run on the PLC (and/or otherdevices). The data collecting application can be further configured tocollected data associated with the PLC, or associated with other deviceson which it runs.

Example users of the ICS 100 include, for example and withoutlimitation, operators of an industrial plant or engineers that canupdate the control logic of a plant. By way of an example, an operatorcan interact with the HMIs 132, which may be located in a control roomof a given plant. Alternatively, or additionally, an operator caninteract with HMIs of the ICS 100 that are located remotely from theproduction network 104. Similarly, for example, engineers can use theHMIs 116 that can be located in an engineering room of the ICS 100.Alternatively, or additionally, an engineer can interact with HMIs ofthe ICS 100 that are located remotely from the production network 104.

In some examples, the ICS 100 includes a management system that includesa user interface. The user interface can be configured to visually oraudibly render alerts. The user interface can also be configured toreceive commands, such that, for example, a security team can visualizealerts and/or investigate anomalies. In an example, the managementsystem further includes a data export interface configured to send thedata that is collected to a commercial security information and eventmanagement systems (SIEM).

Referring also to FIG. 2, an example interface 200 can be displayed bythe management system or by various displays within the ICS 100. By wayof example, and without limitation, the MES 136, HMIs 132, ES 138, andthe mobile data collector 130 can be configured to display informationfor monitoring and controlling a distributed system. In particular, forexample, the MES 136, HMIs 132, ES 138, and the mobile data collector130 can be configured to display the interface 200.

Referring in particular to FIG. 2, the example interface 200 can definevarious views that can be presented at the same time on the sameinterface, or at different times. The views can be connected, such thata selection in one view affects a change in another view in accordancewith the selection. The example interface 200 includes an example Sankeyview 202, though it will be understood that the example interface 200may include additional views as desired, such as a logical view ortimeline view. The Sankey view 202 includes elements of the ICS 100(system elements). Any node or machine of the ICS 100 can be considereda system element. Each system element defines a consumer 204 or provider206. The consumers 204 can send information to the providers 206. Basedon the information, the providers 206 can provide a service that theconsumers 204 can use or consume. The Sankey view 202 can illustratevarious connections 208 between system elements, for instance betweenconsumers 204 and providers 206. The connections 208 can be displayed soas provide a user with various information, such as, for example andwithout limitation: which system elements are connected with oneanother; the type of connection between given system elements; and usageinformation related to the connection between specific system elements.By way of further example, with respect to a particular connection, theinterface 200, for instance the Sankey view 202, may indicate the systementities that are connected, a connection ID, the time when theconnection was established, a time for disconnecting a connection, thetype of connection, and the like. Usage information may include, forexample, data type that is sent, data type that is received, sendingtime, receiving time, a number of data at the sender and/or at thereceiver, frequency intensity of a connection, age of a connection,status associated with a connection (e.g., disconnected or connected),elapsed time since a disconnection, throughput associated with aconnection, state of a connection (e.g., normal states, abnormal states,error state, warning state), or the like. Further, with respect to aconnection that defines an abnormal state, the Sankey view 202 mayindicate an error, an occurrence time of the error, an error type, theconnection ID associated with the error, or the like.

In various embodiments, connections that are displayed define variousvisual encodings for a user. In particular, by viewing the visualcharacteristics of the connections 208 on a display, a user canascertain various properties of the connections 208, and thus of the ICS100. For example, a given connection 208 between two system elements(e.g., a consumer and provider) can define a thickness 210. In someexamples, the representation of the consumers 204 on the interface 200are spaced from the representation of the providers 206 along a first orlateral direction D1, and the thickness 210 can be defined along asecond or transverse direction D2 that is substantially perpendicular tothe lateral direction, though it will be understood that therepresentations of consumers and providers can be alternatively arrangedas desired. In an example, referring also to FIG. 6, the thickness 210can encode the number of connections between two respective systemelements. In some cases, as the number of connections increases betweena given consumer and provider, the thickness 210 of the respectiveconnection 208 increases between the given consumer and provider. Forexample, referring to FIG. 6, example visual encodings 600 associatedwith connections are shown. In particular, example thickness connectionencodings 602 are shown. In an example, a first connection encoding 602a defines a first thickness that is less than a second thickness definedby a second connection encoding 602 b, which is less than a thirdthickness defined by a third encoding 602 c. Thus, in accordance withthe example, system elements that are displayed as coupled together withthe first connection encoding 602 a have less connections than systemelements that are displayed as coupled together with the secondconnection encoding 602 b, which has less connections than systemelements that are displayed as coupled together with a third connectionencoding 602 c. It will be understood that any number of thicknessconnection encodings can be displayed to encode additional numbers ofconnections or alterative characteristics or properties of connections208, and all such connection encodings are contemplated as being withinthe scope of this disclosure.

With continuing reference to FIG. 6, color or shading can also encodevarious properties of connections within the ICS 100, so that a user caneasily identify such properties. For example, a given connection 208between two system elements can define a shade, color, pattern, or thelike. In some cases, the frequency of skill use, or the frequency inwhich a particular consumer uses a skill or service provided by aparticular provider, is indicated to a user by various color hueconnection encodings 604. In some cases, as the frequency of useincreases between a given consumer and provider, the color hueconnection encoding 604 of the respective connection 208 between thegiven consumer and provider darkens. For example, a first colorconnection encoding 604 a defines a first hue that is lighter than asecond hue defined by a second color connection encoding 604 b, which islighter than a second hue defined by a third color connection encoding604 c. Thus, in accordance with the example, system elements that aredisplayed as coupled together with the first color connection encoding604 a are used less frequently than system elements that are displayedas coupled together with the second color connection encoding 604 b,which is used less frequently than system elements that are displayed ascoupled together with a third color connection encoding 604 c. It willbe understood that any number of colors, hues or patterns, can bedisplayed to encode additional frequencies associated with connectionsor alterative characteristics or properties of connections 208, and allsuch color connection encodings are contemplated as being within thescope of this disclosure. For example, the visual encodings 600 mayinclude various error connection encodings 606 that indicate an errorassociated with the respective connection. The color or pattern definedby the error connection encoding may vary depending on the severity ofthe error or the like.

Still referring to FIG. 6, texture or segmentation can also encodevarious properties of connections within the ICS 100, so that a user caneasily identify such properties. For example, a given connection 208between two system elements can define a segmented pattern. In somecases, the age of a particular connection is indicated to a user byvarious segmented pattern encodings 608. In an example, as the age ofconnection between a given consumer and provider increases, thesegmented pattern encoding 608 of the respective connection 208 betweenthe given consumer and provider includes less or longer segments. Thesegments can define a length along the first or lateral direction thatis substantially perpendicular to the thickness 210 of the segment. Forexample, a first segmented pattern encoding 608 a defines segmentshaving a longer length than segments defined by a second segmentedpattern encoding 608 b, which defines segments having a longer lengththan segments defined by a third segmented pattern encoding 608 c. Inaccordance with an example, system elements that are displayed ascoupled together with the first segmented pattern encoding 608 a havebeen connected greater than one hour, or longer than system elementshave been connected that are displayed as coupled together with thesecond segmented pattern encoding 608 b (e.g., less than one hour),which has been connected longer than system elements that are displayedas coupled together with a third segmented pattern encoding 608 c (e.g.,less than one minute). It will be understood that any number of segmentshaving any number of lengths can be displayed to encode additional oralternative connection ages or time periods, or alterative connectionproperties, and all such segmented connection encodings are contemplatedas being within the scope of this disclosure.

In some examples, the visual encodings 600 may include various deadconnection encodings 610 that indicate a connection that was previouslyactive is no longer active or is disconnected. The color (shading) orpattern defined by the dead connection encoding 610 may vary dependingon the length of time that the connection has been inactive or the like.Similarly, the visual encodings 600 may include various activeconnection encodings 612 to indicate that a transfer is occurring overthe respective connection. In an example, the active connection encoding612 defines an orange or bright color, though it will be understood thatthe color of active connection encodings can vary as desired. Forexample, a first active connection encoding 612 a can include a firstcolor that indicates a normal transfer, a second active connectionencoding 612 b can include a second color that indicates an error in therespective transfer, and a third active connection encoding 612 c caninclude a third color that indicates a warning associated with therespective transfer. In some cases, a warning defines a less criticalanomaly as compared to an error. For example, a warning might notrequire an immediate operation intervention, whereas an error mightrequire an intervention to resolve. A warning can include an indicationof a future potential occurrence (e.g., a consumable needs to refilledwithin a certain time period or else production may stop). In contrast,an error indication may lead to a stop in production, which may requirean immediate operator intervention.

Referring again to FIG. 6, movement of the displayed representation of aconnection can also encode various properties of connections within theICS 100, so that a user can easily identify such properties. Forexample, a given connection 208 between two system elements can definemovement in the direction of the transfer of data, for instance from theconsumer toward the provider or the from provider toward the consumer.In some cases, the status and frequency of a particular transfer isindicated to a user by various movement pattern encodings 614. In anexample, as the frequency of an active transfer increases between agiven consumer and provider, the movement pattern encoding 614 of therespective connection 208 between the given consumer and providerdefines more movement or shading gradients. For example, a first activemovement pattern encoding 614 a defines less movement or shadinggradients than movement or shading gradients defined by a second activemovement pattern encoding 614 b, which defines less movement or shadinggradients than movement or shading gradients defined by a third activemovement pattern encoding 614 c. In accordance with an example, systemelements that are displayed as coupled together with the first activemovement pattern encoding 614 a (e.g., light transfer) have less databeing transferred than system elements that are displayed as coupledtogether with the second active movement pattern encoding 614 b (e.g.,normal transfer), which has less data being transferred than systemelements that are displayed as coupled together with the third activemovement pattern encoding 614 c (e.g., heavy transfer). It will beunderstood that any active movement patterns can be displayed to encodeadditional or alternative transfer frequencies, or alterative connectionproperties, and all such active movement pattern encodings arecontemplated as being within the scope of this disclosure.

Referring to FIG. 3, another example interface 300 defines a logicalview 301, a timeline view 303, and a Sankey view 302 that represents aportion of the Sankey view 202. The Sankey view 302 shows theconnections from a select consumer 204 a, which include a first provider206 a, a second provider 206 b, a third provider 206 c, and a fourthprovider 206 d. In various examples, the user can select a consumer 204or provider 206 via the interfaces 200. For example, the user can selectthe consumer 204 a from the logical view 301, in particular a pull downmenu 304 on the logical view 301. Such a selection can automaticallychange the Sankey view 302 and the timeline view 303. For example, theselection of the consumer 204 a on the logical view 301 can result inthe consumer 204 a and its associated connections 208 in the Sankey view302 being highlighted or shown individually. Similarly, a selection inthe Sankey view 302 of particular consumers or provides can result inthe selected consumers or providers and associated data being heightedor shown in the logical view 301 and timeline view 303. Thus, thevarious views of a particular interface can be dependent upon another.

The selections can be made via pull down menu or other actuation definedby the interfaces. For example, responsive to the consumer 204 a beingselected via the interface 200, the connections that involve theconsumer 204 a are presented in bold via the interface, in particularthe view 302. In some cases, responsive to the consumer 204 a beingselected via the interface 200, only the connections that involve theconsumer 204 a are presented via the interface 300, such that no otherconnections are displayed. The user can use the interface 300 to selectalternative or additional consumers or providers.

Referring now to FIG. 4, in accordance with some embodiments,communicating entities can be grouped together. Such grouping canfurther enable communicating entities to be displayed on a screen havinglimited size, such as a desktop monitor, tablet, or mobile phone. Anexample interface 400 defines a Sankey view 402 in which two groups areaggregated and visualized, though it will be understood that groups canalternatively be constructed, and such groups are contemplated as beingwithin the scope of this disclosure.

Referring also to FIG. 5, another example interface 500 defines a Sankeyview 502 that represents a portion of the logical view 402. The logicalview 502 shows the connections from a first and second group ofconsumers 504 a and 504 b, respectively. In various examples, the usercan select groups of consumers or providers. The selections can be madevia pull down menu or other actuation defined by the interfaces. Forexample, responsive to the groups 504 a and 504 b being selected via theinterface 400, the connections that involve the groups are presented inbold via the interface, in particular the view 502. In some cases,responsive to the groups being selected via the interface, only theconnections that involve the selected group of system elements arepresented via the interface 300, such that no other connections aredisplayed.

As described herein, the example views define domain agnostic views ofdistributed systems. Such views can include system elements, connectionsbetween system elements, usage information associated with connectionsand operations, and the like. Further, such views are configured to bedisplayed on mobile devices or other devices having limited displaysizes. The views can be filtered by user selections, so that particularconnections or system elements are displayed. Further, a user selectionin on view can be applied to other views. Various information can beencoded in the connected system elements that are displayed, such as,for example and without limitation, types of connections, usageinformation between system elements, frequency intensity, age, statuses(e.g., connected, disconnected), elapsed time since a disconnection,throughput, and states (e.g., different states of normal, differentstates of abnormal). Without being bound by theory, the views andinformation displays described herein can define a reusable interactionparadigm for various distributed systems across various domains, whichcan result in reduced training for operators. Further, the informationand views described herein can enable operators to efficientlyunderstand various properties of a distributed system, such as itscurrent status or the root cause of a problem. By doing so, theinformation and views described herein can also enable operators usinglimited display sizes to initiate effective responses to variousproblems in an effective manner, for a variety of distributed systems.

In particular, for example, as described herein, a distributed controlsystem can include a production network configured to perform automatedcontrol operations. The production network can include one or more dataextraction nodes and a plurality of devices in communication with thedata extraction nodes. The data extraction nodes can be configured tocollect data from the plurality of devices, the data indicatingconnection information associated with the plurality of devices. Thesystem can further include a screen configured to display a plurality ofinterfaces that include the plurality of devices represented asconsumers and providers. The system can further include a processor amemory storing instructions that, when executed by the processor, causethe processor to encode the connection information so as to defineencoded connection information that indicates one or more propertiesassociated with connections defined between respective providers andrespective consumers. The screen is further configured to display theencoded connection information between respective consumers andproviders. In some cases, as shown herein, the screen is furtherconfigured to display the encoded connection information as lines thatconnect providers with consumers that are associated with respectiveencoded connection information.

In an example, each line defines a thickness that indicates a number ofconnections between consumers and providers coupled together with therespective line. Each line can define a hue that indicates a frequencyin which one or more skills are used by a consumer coupled to therespective line. By way of further example, each line can define a colorthat indicates a state of a respective transfer between one or moreconsumers and one or more providers coupled together with the respectiveline. Additionally, or alternatively, each line can define a movement orshading gradient that defines a frequency. The frequency of the movementor color shading gradient can indicate a size of a respective transferbetween one or more consumers and one or more providers coupled togetherwith the respective line. By way of yet another example, each line candefine a segmentation pattern that defines a length. The length of thesegmentation pattern can indicate a connection time of a respectiveconnection between one or more consumers and one or more providerscoupled together with the respective line.

In some examples, the distributed control system includes a screen thatdefines a single desktop monitor or a mobile device display. In variousexamples, responsive to a user actuation, the processor of the systemcan group a set of consumers together so as to define a grouped systemelement. The screen can be configured to display the encoded connectioninformation between respective providers and the grouped system element.Alternatively, or additionally, the processor can be configured to groupa set of providers together so as to define a grouped system element,responsive to a user actuation, such as a user making a selection from adrop down menu. The screen can be further configured to display theencoded connection information between respective consumers and thegrouped system element. As described herein, the plurality of interfacescan each define a plurality of different views (e.g., logical, Sankey,timeline, etc.), and the screen can be configured to display theplurality of views at the same time. Responsive to a user selection in afirst view of the plurality of views, the screen can change the displayin a second view of the plurality of views, such that the first andsecond views are dependent on each other.

FIG. 7 illustrates an example of a computing environment within whichembodiments of the present disclosure may be implemented. A computingenvironment 700 includes a computer system 510 that may include acommunication mechanism such as a system bus 521 or other communicationmechanism for communicating information within the computer system 510.The computer system 510 further includes one or more processors 520coupled with the system bus 521 for processing the information. Therobot device 104 may include, or be coupled to, the one or moreprocessors 520.

The processors 520 may include one or more central processing units(CPUs), graphical processing units (GPUs), or any other processor knownin the art. More generally, a processor as described herein is a devicefor executing machine-readable instructions stored on a computerreadable medium, for performing tasks and may comprise any one orcombination of, hardware and firmware. A processor may also comprisememory storing machine-readable instructions executable for performingtasks. A processor acts upon information by manipulating, analyzing,modifying, converting or transmitting information for use by anexecutable procedure or an information device, and/or by routing theinformation to an output device. A processor may use or comprise thecapabilities of a computer, controller or microprocessor, for example,and be conditioned using executable instructions to perform specialpurpose functions not performed by a general purpose computer. Aprocessor may include any type of suitable processing unit including,but not limited to, a central processing unit, a microprocessor, aReduced Instruction Set Computer (RISC) microprocessor, a ComplexInstruction Set Computer (CISC) microprocessor, a microcontroller, anApplication Specific Integrated Circuit (ASIC), a Field-ProgrammableGate Array (FPGA), a System-on-a-Chip (SoC), a digital signal processor(DSP), and so forth. Further, the processor(s) 520 may have any suitablemicroarchitecture design that includes any number of constituentcomponents such as, for example, registers, multiplexers, arithmeticlogic units, cache controllers for controlling read/write operations tocache memory, branch predictors, or the like. The microarchitecturedesign of the processor may be capable of supporting any of a variety ofinstruction sets. A processor may be coupled (electrically and/or ascomprising executable components) with any other processor enablinginteraction and/or communication there-between. A user interfaceprocessor or generator is a known element comprising electroniccircuitry or software or a combination of both for generating displayimages or portions thereof. A user interface comprises one or moredisplay images enabling user interaction with a processor or otherdevice.

The system bus 521 may include at least one of a system bus, a memorybus, an address bus, or a message bus, and may permit exchange ofinformation (e.g., data (including computer-executable code), signaling,etc.) between various components of the computer system 510. The systembus 521 may include, without limitation, a memory bus or a memorycontroller, a peripheral bus, an accelerated graphics port, and soforth. The system bus 521 may be associated with any suitable busarchitecture including, without limitation, an Industry StandardArchitecture (ISA), a Micro Channel Architecture (MCA), an Enhanced ISA(EISA), a Video Electronics Standards Association (VESA) architecture,an Accelerated Graphics Port (AGP) architecture, a Peripheral ComponentInterconnects (PCI) architecture, a PCI-Express architecture, a PersonalComputer Memory Card International Association (PCMCIA) architecture, aUniversal Serial Bus (USB) architecture, and so forth.

Continuing with reference to FIG. 7, the computer system 510 may alsoinclude a system memory 530 coupled to the system bus 521 for storinginformation and instructions to be executed by processors 520. Thesystem memory 530 may include computer readable storage media in theform of volatile and/or nonvolatile memory, such as read only memory(ROM) 531 and/or random access memory (RAM) 532. The RAM 532 may includeother dynamic storage device(s) (e.g., dynamic RAM, static RAM, andsynchronous DRAM). The ROM 531 may include other static storagedevice(s) (e.g., programmable ROM, erasable PROM, and electricallyerasable PROM). In addition, the system memory 530 may be used forstoring temporary variables or other intermediate information during theexecution of instructions by the processors 520. A basic input/outputsystem 533 (BIOS) containing the basic routines that help to transferinformation between elements within computer system 510, such as duringstart-up, may be stored in the ROM 531. RAM 532 may contain data and/orprogram modules that are immediately accessible to and/or presentlybeing operated on by the processors 520. System memory 530 mayadditionally include, for example, operating system 534, applicationprograms 535, and other program modules 536. Application programs 535may also include a user portal for development of the applicationprogram, allowing input parameters to be entered and modified asnecessary.

The operating system 534 may be loaded into the memory 530 and mayprovide an interface between other application software executing on thecomputer system 510 and hardware resources of the computer system 510.More specifically, the operating system 534 may include a set ofcomputer-executable instructions for managing hardware resources of thecomputer system 510 and for providing common services to otherapplication programs (e.g., managing memory allocation among variousapplication programs). In certain example embodiments, the operatingsystem 534 may control execution of one or more of the program modulesdepicted as being stored in the data storage 540. The operating system534 may include any operating system now known or which may be developedin the future including, but not limited to, any server operatingsystem, any mainframe operating system, or any other proprietary ornon-proprietary operating system.

The computer system 510 may also include a disk/media controller 543coupled to the system bus 521 to control one or more storage devices forstoring information and instructions, such as a magnetic hard disk 541and/or a removable media drive 542 (e.g., floppy disk drive, compactdisc drive, tape drive, flash drive, and/or solid state drive). Storagedevices 540 may be added to the computer system 510 using an appropriatedevice interface (e.g., a small computer system interface (SCSI),integrated device electronics (IDE), Universal Serial Bus (USB), orFireWire). Storage devices 541, 542 may be external to the computersystem 510.

The computer system 510 may also include a field device interface 565coupled to the system bus 521 to control a field device 566, such as adevice used in a production line. The computer system 510 may include auser input interface or GUI 561, which may comprise one or more inputdevices, such as a keyboard, touchscreen, tablet and/or a pointingdevice, for interacting with a computer user and providing informationto the processors 520.

The computer system 510 may perform a portion or all of the processingsteps of embodiments of the invention in response to the processors 520executing one or more sequences of one or more instructions contained ina memory, such as the system memory 530. Such instructions may be readinto the system memory 530 from another computer readable medium ofstorage 540, such as the magnetic hard disk 541 or the removable mediadrive 542. The magnetic hard disk 541 (or solid state drive) and/orremovable media drive 542 may contain one or more data stores and datafiles used by embodiments of the present disclosure. The data store 540may include, but are not limited to, databases (e.g., relational,object-oriented, etc.), file systems, flat files, distributed datastores in which data is stored on more than one node of a computernetwork, peer-to-peer network data stores, or the like. The data storesmay store various types of data such as, for example, skill data, sensordata, or any other data generated in accordance with the embodiments ofthe disclosure. Data store contents and data files may be encrypted toimprove security. The processors 520 may also be employed in amulti-processing arrangement to execute the one or more sequences ofinstructions contained in system memory 530. In alternative embodiments,hard-wired circuitry may be used in place of or in combination withsoftware instructions. Thus, embodiments are not limited to any specificcombination of hardware circuitry and software.

As stated above, the computer system 510 may include at least onecomputer readable medium or memory for holding instructions programmedaccording to embodiments of the invention and for containing datastructures, tables, records, or other data described herein. The term“computer readable medium” as used herein refers to any medium thatparticipates in providing instructions to the processors 520 forexecution. A computer readable medium may take many forms including, butnot limited to, non-transitory, non-volatile media, volatile media, andtransmission media. Non-limiting examples of non-volatile media includeoptical disks, solid state drives, magnetic disks, and magneto-opticaldisks, such as magnetic hard disk 541 or removable media drive 542.Non-limiting examples of volatile media include dynamic memory, such assystem memory 530. Non-limiting examples of transmission media includecoaxial cables, copper wire, and fiber optics, including the wires thatmake up the system bus 521. Transmission media may also take the form ofacoustic or light waves, such as those generated during radio wave andinfrared data communications.

Computer readable medium instructions for carrying out operations of thepresent disclosure may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++ or the like, andconventional procedural programming languages, such as the “C”programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computeror entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including a local area network (LAN) or a wide areanetwork (WAN), or the connection may be made to an external computer(for example, through the Internet using an Internet Service Provider).In some embodiments, electronic circuitry including, for example,programmable logic circuitry, field-programmable gate arrays (FPGA), orprogrammable logic arrays (PLA) may execute the computer readableprogram instructions by utilizing state information of the computerreadable program instructions to personalize the electronic circuitry,in order to perform aspects of the present disclosure.

Aspects of the present disclosure are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of thedisclosure. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, may be implemented bycomputer readable medium instructions.

The computing environment 700 may further include the computer system510 operating in a networked environment using logical connections toone or more remote computers, such as remote computing device 580. Thenetwork interface 570 may enable communication, for example, with otherremote devices 580 or systems and/or the storage devices 541, 542 viathe network 571. Remote computing device 580 may be a personal computer(laptop or desktop), a mobile device, a server, a router, a network PC,a peer device or other common network node, and typically includes manyor all of the elements described above relative to computer system 510.When used in a networking environment, computer system 510 may includemodem 572 for establishing communications over a network 571, such asthe Internet. Modem 572 may be connected to system bus 521 via usernetwork interface 570, or via another appropriate mechanism.

Network 571 may be any network or system generally known in the art,including the Internet, an intranet, a local area network (LAN), a widearea network (WAN), a metropolitan area network (MAN), a directconnection or series of connections, a cellular telephone network, orany other network or medium capable of facilitating communicationbetween computer system 510 and other computers (e.g., remote computingdevice 580). The network 571 may be wired, wireless or a combinationthereof. Wired connections may be implemented using Ethernet, UniversalSerial Bus (USB), RJ-6, or any other wired connection generally known inthe art. Wireless connections may be implemented using Wi-Fi, WiMAX, andBluetooth, infrared, cellular networks, satellite or any other wirelessconnection methodology generally known in the art. Additionally, severalnetworks may work alone or in communication with each other tofacilitate communication in the network 571.

It should be appreciated that the program modules, applications,computer-executable instructions, code, or the like depicted in FIG. 7as being stored in the system memory 530 are merely illustrative and notexhaustive and that processing described as being supported by anyparticular module may alternatively be distributed across multiplemodules or performed by a different module. In addition, various programmodule(s), script(s), plug-in(s), Application Programming Interface(s)(API(s)), or any other suitable computer-executable code hosted locallyon the computer system 510, the remote device 580, and/or hosted onother computing device(s) accessible via one or more of the network(s)571, may be provided to support functionality provided by the programmodules, applications, or computer-executable code depicted in FIG. 7and/or additional or alternate functionality. Further, functionality maybe modularized differently such that processing described as beingsupported collectively by the collection of program modules depicted inFIG. 7 may be performed by a fewer or greater number of modules, orfunctionality described as being supported by any particular module maybe supported, at least in part, by another module. In addition, programmodules that support the functionality described herein may form part ofone or more applications executable across any number of systems ordevices in accordance with any suitable computing model such as, forexample, a client-server model, a peer-to-peer model, and so forth. Inaddition, any of the functionality described as being supported by anyof the program modules depicted in FIG. 7 may be implemented, at leastpartially, in hardware and/or firmware across any number of devices.

It should further be appreciated that the computer system 510 mayinclude alternate and/or additional hardware, software, or firmwarecomponents beyond those described or depicted without departing from thescope of the disclosure. More particularly, it should be appreciatedthat software, firmware, or hardware components depicted as forming partof the computer system 510 are merely illustrative and that somecomponents may not be present or additional components may be providedin various embodiments. While various illustrative program modules havebeen depicted and described as software modules stored in system memory530, it should be appreciated that functionality described as beingsupported by the program modules may be enabled by any combination ofhardware, software, and/or firmware. It should further be appreciatedthat each of the above-mentioned modules may, in various embodiments,represent a logical partitioning of supported functionality. Thislogical partitioning is depicted for ease of explanation of thefunctionality and may not be representative of the structure ofsoftware, hardware, and/or firmware for implementing the functionality.Accordingly, it should be appreciated that functionality described asbeing provided by a particular module may, in various embodiments, beprovided at least in part by one or more other modules. Further, one ormore depicted modules may not be present in certain embodiments, whilein other embodiments, additional modules not depicted may be present andmay support at least a portion of the described functionality and/oradditional functionality. Moreover, while certain modules may bedepicted and described as sub-modules of another module, in certainembodiments, such modules may be provided as independent modules or assub-modules of other modules.

Although specific embodiments of the disclosure have been described, oneof ordinary skill in the art will recognize that numerous othermodifications and alternative embodiments are within the scope of thedisclosure. For example, any of the functionality and/or processingcapabilities described with respect to a particular device or componentmay be performed by any other device or component. Further, whilevarious illustrative implementations and architectures have beendescribed in accordance with embodiments of the disclosure, one ofordinary skill in the art will appreciate that numerous othermodifications to the illustrative implementations and architecturesdescribed herein are also within the scope of this disclosure. Inaddition, it should be appreciated that any operation, element,component, data, or the like described herein as being based on anotheroperation, element, component, data, or the like can be additionallybased on one or more other operations, elements, components, data, orthe like. Accordingly, the phrase “based on,” or variants thereof,should be interpreted as “based at least in part on.”

Although embodiments have been described in language specific tostructural features and/or methodological acts, it is to be understoodthat the disclosure is not necessarily limited to the specific featuresor acts described. Rather, the specific features and acts are disclosedas illustrative forms of implementing the embodiments. Conditionallanguage, such as, among others, “can,” “could,” “might,” or “may,”unless specifically stated otherwise, or otherwise understood within thecontext as used, is generally intended to convey that certainembodiments could include, while other embodiments do not include,certain features, elements, and/or steps. Thus, such conditionallanguage is not generally intended to imply that features, elements,and/or steps are in any way required for one or more embodiments or thatone or more embodiments necessarily include logic for deciding, with orwithout user input or prompting, whether these features, elements,and/or steps are included or are to be performed in any particularembodiment.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present disclosure. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

Without being bound by theory, it is recognized herein that generatingmodels that focus on a specific user and/or role, in accordance withvarious embodiments, can enhance security capabilities as compared togeneric anomaly detection models, such as models that focus on users ina corporate network. For example, such focused models can be used todetect security and/or safety events that might not otherwise beidentified.

What is claimed is:
 1. A distributed control system comprising: aproduction network configured to perform automated control operations,the production network comprising one or more data extraction nodes anda plurality of devices in communication with the data extraction nodes,the data extraction nodes configured to collect data from the pluralityof devices, the data indicating connection information associated withthe plurality of devices; a screen configured to display a plurality ofinterfaces that include the plurality of devices represented asconsumers and providers; a processor; and a memory storing instructionsthat, when executed by the processor, cause the processor to encode theconnection information so as to define encoded connection informationthat indicates one or more properties associated with connectionsdefined between respective providers and respective consumers, whereinthe screen is further configured to display the encoded connectioninformation between respective consumers and providers.
 2. Thedistributed control system as recited in claim 1, wherein the screen isfurther configured to display the encoded connection information aslines that connect providers with consumers that are associated withrespective encoded connection information.
 3. The distributed controlsystem as recited in claim 2, wherein each line defines a thickness, thethickness indicating a number of connections between consumers andproviders coupled together with the respective line.
 4. The distributedcontrol system as recited in claim 2, wherein each line defines a hue,the hue indicating a frequency in which one or more skills are used by aconsumer coupled to the respective line.
 5. The distributed controlsystem as recited in claim 2, wherein each line defines a color, thecolor indicating a state of a respective transfer between one or moreconsumers and one or more providers coupled together with the respectiveline.
 6. The distributed control system as recited in claim 2, whereineach line defines a movement or shading gradient that defines afrequency, the frequency of the movement or color shading gradientindicating a size of a respective transfer between one or more consumersand one or more providers coupled together with the respective line. 7.The distributed control system as recited in claim 2, wherein each linedefines a segmentation pattern that defines a length, the length of thesegmentation pattern indicating a connection time of a respectiveconnection between one or more consumers and one or more providerscoupled together with the respective line.
 8. The distributed controlsystem as recited in claim 1, wherein the screen defines a singledesktop monitor or a mobile device display.
 9. The distributed controlsystem as recited in claim 1, the memory storing further instructionsthat, when executed by the processor, cause the processor to: responsiveto a user actuation, group a set of consumers together so as to define agrouped system element, wherein the screen is further configured todisplay the encoded connection information between respective providersand the grouped system element.
 10. The distributed control system asrecited in claim 1, the memory further storing instructions that, whenexecuted by the processor, cause the processor to: responsive to a useractuation, group a set of providers together so as to define a groupedsystem element, wherein the screen is further configured to display theencoded connection information between respective consumers and thegrouped system element.
 11. The distributed control system of claim 1,wherein the plurality of interfaces each define a plurality of views,and wherein the screen is further configured: display the plurality ofviews at the same time; and responsive to a user selection in a firstview of the plurality of views, change the display in a second view ofthe plurality of views, such that the first and second views aredependent on each other.
 12. A method performed in a distributed controlsystem, the method comprising: collecting data from a plurality ofdevices within the distributed control system, the data indicatingconnection information associated with the plurality of devices;displaying a plurality of interfaces that include the plurality ofdevices represented as consumers and providers; encoding the connectioninformation so as to define encoded connection information thatindicates one or more properties associated with connections definedbetween respective providers and respective consumers; and displayingthe encoded connection information between respective consumers andproviders.
 13. The method as recited in claim 12, the method furthercomprising: displaying the encoded connection information as lines thatconnect providers with consumers that are associated with respectiveencoded connection information.
 14. The method as recited in claim 13,wherein each line defines a thickness, the thickness indicating a numberof connections between consumers and providers coupled together with therespective line.
 15. The method as recited in claim 13, wherein eachline defines a hue, the hue indicating a frequency in which one or moreskills are used by a consumer coupled to the respective line.
 16. Themethod as recited in claim 13, wherein each line defines a color, thecolor indicating a state of a respective transfer between one or moreconsumers and one or more providers coupled together with the respectiveline.
 17. The method as recited in claim 13, wherein each line defines amovement or shading gradient that defines a frequency, the frequency ofthe movement or color shading gradient indicating a size of a respectivetransfer between one or more consumers and one or more providers coupledtogether with the respective line.
 18. The method as recited in claim13, wherein each line defines a segmentation pattern that defines alength, the length of the segmentation pattern indicating a connectiontime of a respective connection between one or more consumers and one ormore providers coupled together with the respective line.
 19. The methodas recited in claim 12, the method further comprising: responsive to auser actuation, grouping a set of consumers together so as to define agrouped system element; and displaying the encoded connectioninformation between respective providers and the grouped system element.20. The method as recited in claim 12, wherein the plurality ofinterfaces each define a plurality of views, the method furthercomprising: displaying the plurality of views at the same time; andresponsive to a user selection in a first view of the plurality ofviews, changing the display in a second view of the plurality of views,such that the first and second views are dependent on each other.